Getting Data In

Why isn't this data indexing?

danillopavan
Communicator

Hello all,

I am trying to filter the data to be indexed however not success. Nothing is indexed.

I have the below log file:

< 2017-12-06 16:25:44.569 Script: Session started.
< 2017-12-06 16:25:44.569 Executing user defined command on command session.
> 2017-12-06 16:25:44.569 [Shell] df -gt /amb/local/sap_sd ; echo "WinSCP: this is end-of-file:$?"
< 2017-12-06 16:25:44.569 Script: Filesystem    GB blocks      Used      Free %Used Mounted on
< 2017-12-06 16:25:44.569 [Shell] Filesystem    GB blocks      Used      Free %Used Mounted on
< 2017-12-06 16:25:44.569 Script: /dev/lvsapsd       9.00      5.21      3.79   58% /amb/local/sap_sd
< 2017-12-06 16:25:44.569 [Shell] /dev/lvsapsd       9.00      5.21      3.79   58% /amb/local/sap_sd
< 2017-12-06 16:25:44.569 [Shell] WinSCP: this is end-of-file:0
> 2017-12-06 16:25:44.569 [Shell] pwd ; echo "WinSCP: this is end-of-file:$?"

And i just would like to index the lines that containing the word "lvsapsd " (4th and 5th lines).

I have configured my props.conf and transforms.conf as below:

[sourcetype]
TRANSFORMS-set= setnull,setparsing

[setnull]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue

[setparsing]
REGEX = .*(\blvsapsd\b).*/g
DEST_KEY = queue
FORMAT = indexQueue
0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Change your transforms.conf entry for setparsing with this (your don't have to match the whole line, specific keywords that can uniquely identify your events to keep will be sufficient)

[setparsing]
 REGEX = lvsapsd
 DEST_KEY = queue
 FORMAT = indexQueue

View solution in original post

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Change your transforms.conf entry for setparsing with this (your don't have to match the whole line, specific keywords that can uniquely identify your events to keep will be sufficient)

[setparsing]
 REGEX = lvsapsd
 DEST_KEY = queue
 FORMAT = indexQueue
0 Karma

danillopavan
Communicator

Just another question...if I would like to include a phrase to be matched like "Script: Filesystem", how I can use in the regex expression?

REGEX = "Script: Filesystem" ?

0 Karma

danillopavan
Communicator

Perfect!! Many thanks!!! 🙂

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...